Home/BoK/Templates/Investigation Intake Form
Back to Hub
Last Reviewed: 2026-06-25
Reviewer Role: Insider Risk / Legal / Privacy review
Advanced Asset
Investigation ModuleInteractive Sheet

Investigation Intake Form

An investigation intake form separates allegations from facts and creates a consistent starting point for legal, HR, security, privacy, and ethics review.

Primary Audience & Scope

Investigators, Legal, HR, Security, Ethics, program managers

When to Use

  • •Triage, investigation, preservation, containment, or legal review is required.
  • •A consistent record is needed across teams.
  • •A matter may require later review, audit, or legal defensibility.

Interactive Work Area

Fill or track items interactively and copy out to your Clipboard

Template Table Structure

FieldWorking prompt
Case/resource field 1Use this field to document: Record referral source and date.
Case/resource field 2Use this field to document: State concern in neutral terms.
Case/resource field 3Use this field to document: List known facts separately from allegations.
Case/resource field 4Use this field to document: Identify affected people, assets, systems, and data.
Case/resource field 5Use this field to document: Identify immediate safety, access, or evidence risks.
Case/resource field 6Use this field to document: Flag legal, HR, privacy, whistleblower, retaliation, or labor review needs.
Case/resource field 7Use this field to document: Name potential evidence sources.
Case/resource field 8Use this field to document: Define initial scope and exclusions.

Checklist Audit List

0% Done(0/10)
Check
Checklist item

Record referral source and date.

Evidence: Owner / date / evidence

State concern in neutral terms.

Evidence: Owner / date / evidence

List known facts separately from allegations.

Evidence: Owner / date / evidence

Identify affected people, assets, systems, and data.

Evidence: Owner / date / evidence

Identify immediate safety, access, or evidence risks.

Evidence: Owner / date / evidence

Flag legal, HR, privacy, whistleblower, retaliation, or labor review needs.

Evidence: Owner / date / evidence

Name potential evidence sources.

Evidence: Owner / date / evidence

Define initial scope and exclusions.

Evidence: Owner / date / evidence

Assign intake owner.

Evidence: Owner / date / evidence

Record intake decision: close, monitor, refer, preserve evidence, open case, or escalate.

Evidence: Owner / date / evidence

What Completion Looks Like

  • 1Decision documented.
  • 2Owner assigned.
  • 3Evidence and actions recorded.
  • 4Scope and authority preserved.
  • 5Follow-up action created where needed.

Insider Risk Capability Framework™ (IRCF™) Alignment

Primary IRCF™ Component
Investigation
Programmatic RelevanceSupports consistent, defensible handling of insider risk matters.
Non-legal-advice Compliance NoteThis resource is a planning aid and does not provide legal advice. Organizations should adapt it to their policies, jurisdictions, labor obligations, privacy requirements, contracts, and risk appetite. Sensitive monitoring, investigation, employment, evidence, legal hold, and employee-data activities should be reviewed by appropriate Legal, Privacy, HR, Compliance, and labor stakeholders before use.

Operationalize This Template in RiskTKO®

Use RiskTKO® or request ITMG® support to adapt this template, align it to the Insider Risk Capability Framework™, and connect the output to measurable exposure reduction. Case Management Record Template

Request an Insider Risk AssessmentSee RiskTKO® in Action